{"action":"Upgrade ansible-core to 2.14.18rc1 or later.","affected":[{"fixed":"2.14.18rc1","introduced":"0"},{"fixed":"2.15.13rc1","introduced":"2.15.0b1"},{"fixed":"2.16.13rc1","introduced":"2.16.0b1"},{"fixed":"2.17.6rc1","introduced":"2.17.0b1"},{"fixed":"2.18.0rc2","introduced":"2.18.0b1"}],"component":"ansible-core","cve_ids":["CVE-2024-9902"],"ecosystem":"PyPI","epss":0.00259,"exploited":false,"fixed_versions":["2.14.18rc1","2.15.13rc1","2.16.13rc1","2.17.6rc1","2.18.0rc2"],"ghsa_id":"GHSA-32p4-gm2c-wmch","id":"tcs_01M5KETKS7YWNCCBSS7EZGPYGB","modified_at":"2026-09-10T03:50:20.316576445Z","published_at":"2024-11-06T12:31:32Z","references":["https://osv.dev/vulnerability/GHSA-32p4-gm2c-wmch","https://nvd.nist.gov/vuln/detail/CVE-2024-9902","https://github.com/ansible/ansible/commit/03794735d370db98a5ec2ad514fab2b0dd22d6be","https://github.com/ansible/ansible/commit/03daf774d0d80fb7235910ed1c2b4fbcaebdfe65","https://github.com/ansible/ansible/commit/3b6de811abea0a811e03e3029222a7e459922892","https://github.com/ansible/ansible/commit/9d7312f695639e804d2caeb1d0f51c716a9ac7dd","https://github.com/ansible/ansible/commit/f7be90626da3035c697623dcf9c90b7a0bc91c92","https://access.redhat.com/errata/RHSA-2024:10762","https://access.redhat.com/errata/RHSA-2024:8969","https://access.redhat.com/errata/RHSA-2024:9894","https://access.redhat.com/errata/RHSA-2025:1861","https://access.redhat.com/security/cve/CVE-2024-9902","https://bugzilla.redhat.com/show_bug.cgi?id=2318271","https://github.com/ansible/ansible","https://lists.debian.org/debian-lts-announce/2024/11/msg00021.html"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-32p4-gm2c-wmch","url":"https://osv.dev/vulnerability/GHSA-32p4-gm2c-wmch"}],"summary":"ansible-core Incorrect Authorization vulnerability"}